Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve CSRF and SPA (CSRF_COOKIE). #972

Merged
merged 1 commit into from
May 2, 2024
Merged

Improve CSRF and SPA (CSRF_COOKIE). #972

merged 1 commit into from
May 2, 2024

Commits on May 2, 2024

  1. Improve CSRF and SPA (CSRF_COOKIE). 

    We used to set the CSRF_COOKIE (if configured) at the end of a successful authentication. For 2-factor that meant that /tf-validate needed to have the CSRF-HEADER set manually (as well as /login).
There seems no reason not to set the CSRF-COOKIE on GET /login - just as we return the csrf_token - so that all endpoints can use the cookie if wanted (which is what many js frameworks do).

There appeared to be no CSRF tests for logging in with unified sign in - now there is.

closes #965
    @jwag956
    jwag956 committed May 2, 2024
    Configuration menu
    Copy the full SHA
    098e964 View commit details
    Browse the repository at this point in the history